7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27896

CVE-2026-27896: MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go's standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27896

CVE-2026-27896:

7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/modelcontextprotocol/go-sdk	go	< 1.3.1	1.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-27896 and GHSA-wvj2-96wp-fq3f, stems from the use of Go's standard encoding/json.Unmarshal function for parsing JSON-RPC and MCP protocol messages. This function performs case-insensitive matching of JSON keys to struct field tags, which violates the JSON-RPC 2.0 specification requiring exact field names. This flaw could allow a malicious actor to craft JSON payloads with altered casing (e.g., "Method" instead of "method") that would be accepted by the Go SDK but potentially bypass security proxies or be rejected by other, stricter MCP SDK implementations (like TypeScript or Python).

The fix, implemented in commit 7b8d81c, was to replace all instances of encoding/json.Unmarshal with a new internal function that utilizes the github.com/segmentio/encoding/json library, configured specifically for case-sensitive decoding.

My analysis of the patch identified numerous functions across the mcp and oauthex packages that were responsible for unmarshaling JSON data from external sources. These functions are considered the vulnerable functions because they were the entry points for potentially malicious, case-altered JSON. Any of these functions would appear in a runtime profile or stack trace during the processing of such a message. The identified functions cover a wide range of protocol operations, from decoding basic messages and content parts to handling tool results, server requests, and OAuth client registration.

Vulnerable functions

internal/jsonrpc2.DecodeMessage

internal/jsonrpc2/messages.go

This function decodes a JSON-RPC message using the vulnerable `json.Unmarshal` which performs case-insensitive matching, allowing a malicious peer to send messages with non-standard field casing (e.g., "Method" instead of "method") that the SDK would silently accept.

mcp.unmarshalContent

mcp/content.go

This function unmarshals content parts from a raw JSON message. It uses the vulnerable `json.Unmarshal` which could lead to inconsistent parsing of content between different MCP SDK implementations and bypass intermediary inspection.

mcp.CallToolResult.UnmarshalJSON

mcp/protocol.go

This method is responsible for unmarshaling a `CallToolResult` from JSON. Its use of the case-insensitive `json.Unmarshal` could lead to misinterpretation of the tool call results.

mcp.CompleteReference.UnmarshalJSON

mcp/protocol.go

This method unmarshals a `CompleteReference`. The case-insensitivity could lead to incorrect parsing of reference objects.

mcp.SamplingMessageV2.UnmarshalJSON

mcp/protocol.go

This method unmarshals a `SamplingMessageV2`. The vulnerability could allow for bypassing security policies that inspect message contents based on exact field names.

mcp.server.toolForErr

mcp/server.go

This function, used on the server side, unmarshals tool input. A malicious client could craft input that is parsed incorrectly, potentially leading to unexpected behavior in tool execution.

mcp.streamableServerConn.servePOST

mcp/streamable.go

This method handles incoming POST requests and unmarshals JSON-RPC request parameters. The vulnerability at this stage could affect the initial processing of requests on the server.

oauthex.RegisterClient

oauthex/dcr.go

This function is used for Dynamic Client Registration in OAuth and unmarshals the registration response. Case-insensitivity here could lead to problems when interacting with OAuth servers that expect strict adherence to the specification.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.